Ports 25 and 587 are blocked and unable to open in azure VM

Question

Ports 25 and 587 are blocked and unable to open in azure VM

Thrilokesh 35

I trying Configure a email with postfix and dovecot . i have installed the postfix and trying to connect to gmail telnet using the telnet gmail-smtp-in.l.google.com 587 .

getting timeout .

i tried add new inbound and outbound rules to my azure vm .but no luck

Alistair Ross 7,466 Reputation points Microsoft Employee

2023-05-19T11:05:17.7133333+00:00

Can you share how you have tried to open the inbound and outbound rules? Is this on a Network security group or a local firewall?
Thrilokesh 35 Reputation points

2023-05-19T12:17:38.4+00:00

I
Thrilokesh 35 Reputation points

2023-05-19T12:18:01.19+00:00

I have added the port in networking security rule
Thrilokesh 35 Reputation points

2023-05-19T12:19:09.27+00:00

i have added in the network security group
Alistair Ross 7,466 Reputation points Microsoft Employee

2023-05-19T12:25:31.1833333+00:00

I see that the source and destination ports are different. Network security groups do not perform any Network Address Translation. Also you have specified the incoming port is 25. It is highly unlikely that the inbound connecting will be on port 25 unless the service you have set up is always transmitting on that port.
Thrilokesh 35 Reputation points

2023-05-19T12:32:25.16+00:00

so do i need give the source and destination both as 25 or 587
VasimTamboli 5,215 Reputation points

2023-05-19T14:05:52.9766667+00:00

If you are unable to open ports 25 and 587 on your Azure VM, there could be a few reasons and steps you can take to troubleshoot the issue:

Azure Network Security Group (NSG) Rules: Check the NSG associated with your VM's subnet or network interface. Ensure that there are inbound and outbound rules allowing traffic on ports 25 and 587. You can create new rules specifically for these ports if they don't exist.

Azure Firewall: If you have Azure Firewall deployed in your virtual network, make sure it allows traffic on ports 25 and 587. Configure the necessary rules in Azure Firewall to permit SMTP traffic.

Operating System Firewall: Check the firewall settings on your Azure VM itself. Ensure that the operating system firewall (e.g., Windows Firewall or iptables on Linux) allows inbound and outbound traffic on ports 25 and 587.

Azure Load Balancer: If you are using an Azure Load Balancer in front of your VMs, verify that it is properly configured to forward traffic on ports 25 and 587 to your VM.

Internet Service Provider (ISP) Restrictions: Some ISPs block outbound connections on ports 25 and 587 to prevent spam. Contact your ISP to check if they are blocking these ports and if there are any specific requirements or alternative ports available for email traffic.

Azure Service Health: Occasionally, there may be service health issues affecting network connectivity in specific Azure regions. Check the Azure Service Health dashboard to see if there are any ongoing issues that could be impacting your VM's network connectivity.

By checking these points and ensuring the appropriate configurations are in place, you should be able to troubleshoot and resolve the issue of blocked ports 25 and 587 on your Azure VM.
Alistair Ross 7,466 Reputation points Microsoft Employee

2023-05-19T14:51:11.3166667+00:00

If you remove the NSG and it works with no issue, then it will be your rules. Chances are that the inbound port needs to be * as outbound traffic is typically sent on a different port
Thrilokesh 35 Reputation points

2023-05-20T04:30:57.17+00:00

Hi i have added new rules for both 25 and 587 for both inbound and outbound . and also allowed these ports in ufw in ubuntu

telnet gmail-smtp-in.l.google.com 25

Trying 64.233.188.27...

Trying 2404:6800:4008:c06::1a...

telnet: Unable to connect to remote host: Network is unreachable

i am currently use the azure free trial subscription and there is a Networking rule DenyAllOutBound and DenyAllInBound which is denying all the avaiable ports . is this reason why ports are not opening ?
Dillon Silzer 57,831 Reputation points Volunteer Moderator

2023-05-22T04:30:10.0233333+00:00

Are you sure you aren't trying to open them up on outbound ports? Inbound ports would mean you have an application sitting on your server that is listening on 25 or 587 (which is highly unlikely).
Christopher Franklin 0 Reputation points

2023-06-05T20:51:11.0866667+00:00

I feel this answer is not useful. The OP is connecting to outbound, not inbound.

Accepted answer

0 additional answers

Your answer

Alistair Ross 7,466 Reputation points Microsoft Employee

2023-05-19T11:05:17.7133333+00:00

Can you share how you have tried to open the inbound and outbound rules? Is this on a Network security group or a local firewall?
Thrilokesh 35 Reputation points

2023-05-19T12:17:38.4+00:00

I
Thrilokesh 35 Reputation points

2023-05-19T12:18:01.19+00:00

I have added the port in networking security rule
Thrilokesh 35 Reputation points

2023-05-19T12:19:09.27+00:00

i have added in the network security group
Alistair Ross 7,466 Reputation points Microsoft Employee

2023-05-19T12:25:31.1833333+00:00

I see that the source and destination ports are different. Network security groups do not perform any Network Address Translation. Also you have specified the incoming port is 25. It is highly unlikely that the inbound connecting will be on port 25 unless the service you have set up is always transmitting on that port.
Thrilokesh 35 Reputation points

2023-05-19T12:32:25.16+00:00

so do i need give the source and destination both as 25 or 587
VasimTamboli 5,215 Reputation points

2023-05-19T14:05:52.9766667+00:00

If you are unable to open ports 25 and 587 on your Azure VM, there could be a few reasons and steps you can take to troubleshoot the issue:

Azure Network Security Group (NSG) Rules: Check the NSG associated with your VM's subnet or network interface. Ensure that there are inbound and outbound rules allowing traffic on ports 25 and 587. You can create new rules specifically for these ports if they don't exist.

Azure Firewall: If you have Azure Firewall deployed in your virtual network, make sure it allows traffic on ports 25 and 587. Configure the necessary rules in Azure Firewall to permit SMTP traffic.

Operating System Firewall: Check the firewall settings on your Azure VM itself. Ensure that the operating system firewall (e.g., Windows Firewall or iptables on Linux) allows inbound and outbound traffic on ports 25 and 587.

Azure Load Balancer: If you are using an Azure Load Balancer in front of your VMs, verify that it is properly configured to forward traffic on ports 25 and 587 to your VM.

Internet Service Provider (ISP) Restrictions: Some ISPs block outbound connections on ports 25 and 587 to prevent spam. Contact your ISP to check if they are blocking these ports and if there are any specific requirements or alternative ports available for email traffic.

Azure Service Health: Occasionally, there may be service health issues affecting network connectivity in specific Azure regions. Check the Azure Service Health dashboard to see if there are any ongoing issues that could be impacting your VM's network connectivity.

By checking these points and ensuring the appropriate configurations are in place, you should be able to troubleshoot and resolve the issue of blocked ports 25 and 587 on your Azure VM.
Alistair Ross 7,466 Reputation points Microsoft Employee

2023-05-19T14:51:11.3166667+00:00

If you remove the NSG and it works with no issue, then it will be your rules. Chances are that the inbound port needs to be * as outbound traffic is typically sent on a different port
Thrilokesh 35 Reputation points

2023-05-20T04:30:57.17+00:00

Hi i have added new rules for both 25 and 587 for both inbound and outbound . and also allowed these ports in ufw in ubuntu

telnet gmail-smtp-in.l.google.com 25

Trying 64.233.188.27...

Trying 2404:6800:4008:c06::1a...

telnet: Unable to connect to remote host: Network is unreachable

i am currently use the azure free trial subscription and there is a Networking rule DenyAllOutBound and DenyAllInBound which is denying all the avaiable ports . is this reason why ports are not opening ?
Dillon Silzer 57,831 Reputation points Volunteer Moderator

2023-05-22T04:30:10.0233333+00:00

Are you sure you aren't trying to open them up on outbound ports? Inbound ports would mean you have an application sitting on your server that is listening on 25 or 587 (which is highly unlikely).
Christopher Franklin 0 Reputation points

2023-06-05T20:51:11.0866667+00:00

I feel this answer is not useful. The OP is connecting to outbound, not inbound.

Answer 1

KapilAnanth-MSFT 49,616 Microsoft Employee Moderator

@Thrilokesh

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to access the FQDN "gmail-smtp-in.l.google.com" on ports 25 and 587.

Please let me know if this is incorrect.

First of all,

Is the server "gmail-smtp-in.l.google.com" accepting requests to port 25 and 587?
I do not think so.
From my local machine, the connections are failing.
This simply indicates that the problem is not with Azure VM, rather the destination server.

Do you have any other VM or working setup(local server) where telnet to Ports 25 and 587 actually succeed?

Also, Please check : Recommended method of sending email

The Azure platform will block outbound SMTP connections on TCP port 25 for deployed VMs
Only exception is customers using Enterprise Agreement

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Thrilokesh 35 Reputation points

2023-05-22T04:50:49.71+00:00

Hi kapil

i tried the gmail telent port in non azure vm which i have at it connecting without any issues .it is azure issue
KapilAnanth-MSFT 49,616 Reputation points Microsoft Employee Moderator

2023-05-22T06:06:50.39+00:00
@Thrilokesh,

With Port 25, yes, you will not be able to make a connection unless you have an Enterprise agreement as stated above.

Please adhere to the recommended method of sending email

Now, wrt Port 587, Can you please share a working scenario screenshot?

I tried to do with my local server and 587 failed.

I also tried to do from online nmap tools for port scan, but 587 kept failing.

In case you have a working Port 587, we can compare the behavior and troubleshoot further.

Cheers,

Kapil
Thrilokesh 35 Reputation points

2023-05-22T06:26:46.14+00:00

yes the gmail is not using 587

i connect my customer email server its working fine with 587
Thrilokesh 35 Reputation points

2023-05-22T06:27:04.12+00:00

yes the gmail is not using 587

i connect my customer email server its working fine with 587
KapilAnanth-MSFT 49,616 Reputation points Microsoft Employee Moderator

2023-05-22T06:34:18.06+00:00

@Thrilokesh,

Thanks for the update.

In that case, I believe we have our answer here.

Users are requested to use authenticated SMTP relay services to send email from Azure VMs or from Azure App Service. (These relay services typically connect through TCP port 587, but they support other ports.)

Should there be any follow up queries, please do let me know and I shall try my best to help you as always :).

If not, I would recommend you to Accept this answer and close this thread as it might be beneficial for other community members reading this thread.

Cheers,

Kapil

Share via

Ports 25 and 587 are blocked and unable to open in azure VM

0 additional answers

Your answer